Blog

How to spend less time on admin

Practical guides for UK businesses on leads, bookkeeping, documents and websites, and what’s new in Adminify.

Websites · 1 Nov 2026 · 6 min read

PHP2Shell: what the PHP vulnerability means for your WordPress site

Two critical flaws in PHP itself made the headlines in October. If your website runs on WordPress, it runs on PHP. Here is what happened, what to do this week, and why it might be the moment to move your site off PHP altogether.

By Adminify
  1. Two critical flaws, nicknamed PHP2Shell, let an attacker take over a web server running PHP without logging in. They affect every PHP version from 5.4 up to 8.5.11, which covers almost every WordPress site on the internet.
  2. Attackers were using them before the fix was released. Update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or get your host to confirm in writing that they have.
  3. Patching fixes these two flaws. It doesn't change the fact that a WordPress site runs code every time someone visits, and that code needs looking after for as long as the site exists. Adminify Folio takes PHP off your live site completely.